This also adds speculative checks asserting that all arguments
are of the right types; each check disables speculation if it
fails.

Bug: v8:7127, v8:6270
Change-Id: Ifcb8bc509b86c712f0fab50ef1caee0c3a289e86
Reviewed-on: https://chromium-review.googlesource.com/832449
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50289}